The invention relates to programmable logic devices (PLDs) subject to single event upsets. More particularly, the invention relates to methods of generating high reliability designs for PLDs on which single event upsets have minimal impact.
Programmable logic devices (PLDs) are a well-known type of digital integrated circuit that can be programmed to perform specified logic functions. One type of PLD, the field programmable gate array (FPGA), typically includes an array of configurable logic blocks (CLBs) surrounded by a ring of programmable input/output blocks (IOBs). Some FPGAs also include additional logic blocks with special purposes (e.g., DLLs, RAM, and so forth).
The various logic blocks are interconnected by a programmable interconnect structure that includes a large number of programmable interconnect lines (e.g., metal wires). The interconnect lines and logic blocks are interconnected using programmable interconnect points (PIPs). A PIP can be, for example, a CMOS passgate. When the passgate is turned on (i.e., the PIP is enabled), the two nodes on either side of the passgate are electrically connected. When the passgate is turned off (i.e., the PIP is disabled), the two nodes are isolated from each other. Thus, by controlling the values on the gate terminals of the PIPS, circuit connections can be easily made and altered.
PIPs can be implemented in many different ways. For example, a buffered PIP can be implemented as a tristate buffer. When the tristate signal is low, the buffer output is not driven, and the two nodes on either side of the buffer are isolated. When the tristate signal is high, one of the nodes drives the other node in a unidirectional connection.
Various exemplary types of PIPs are described by Freeman in U.S. Pat. No. Re. 34,363, by Carter in U.S. Pat. Nos. 4,695,740 and 4,713,557, by Hsieh in U.S. Pat. No. 4,835,418, and by Young in U.S. Pat. No. 5,517,135, all of which are hereby incorporated by reference. Some PIPs are unidirectional and some are bidirectional. Some are buffered and some are not buffered. However, the various types of PIPs typically have this in common, that they are controlled by a single data value stored in a memory cell called a configuration memory cell.
The logic blocks and PIPs in a PLD are typically programmed (configured) by loading configuration data into thousands of configuration memory cells that define how the CLBS, IOBs, and interconnect lines are configured and interconnected. In Field Programmable Gate Arrays (FPGAs), for example, each configuration memory cell is implemented as a static RAM cell.
When subjected to unusual conditions such as cosmic rays or bombardment by neutrons or alpha particles, a static RAM cell can change state. For example, a stored high value can be inadvertently changed to a low value, and vice versa. Sometimes these xe2x80x9csingle event upsetsxe2x80x9d have no effect on the functionality of the chip. At other times, a single event upset can change the function of a PLD such that the circuit no longer functions properly.
FIG. 1 shows a portion of a PLD that includes three logic blocks LB1-LB3, five interconnect lines IL0-IL4, and four PIPs P1-P4. Interconnect lines IL1-IL3 are coupled to logic blocks LB1-LB3, respectively. For simplicity, interconnect lines IL1-IL3 are shown directly connected to the corresponding logic blocks. In practice, the interconnect lines do not necessarily connect directly to the logic blocks, but can pass through additional PIPs to reach the logic blocks. Interconnect lines IL1-IL3 can each be programmably coupled to interconnect line IL0 through PIPs P1-P3, respectively. Interconnect line IL4 can be programmably coupled to interconnect line IL3 through PIP P4.
PIPs P1-P4 are respectively controlled by four memory cells MC1-MC4. When the value stored in one of the memory cells is high, the passgate in the associated PIP is enabled. When the value stored in one of the memory cells is low, the interconnect lines on either side of the associated PIP are not connected together. They can be left unconnected or wired as parts of two separate circuits.
As an example, consider the case where memory cells MC1, MC2, and MC4 each store a high value and memory cell MC3 stores a low value. PIPs P1 and P2 are enabled, connecting together interconnect lines IL1, IL0, and IL2. PIP P4 is also enabled, connecting together interconnect lines IL3 and IL4. PIP P3 is disabled. Further consider that logic block LB1 is driving a signal on interconnect line. IL1 and logic block. LB3 is driving a signal on interconnect line IL3. For example, PIPs P1 and P3 can be included in output drivers of the CLBs including logic blocks LB1 and LB3, respectively. PIPs P1-P4 can also form part of multiplexer structures within logic blocks or CLBs, or within the programmable interconnect structure of the PLD.
Now suppose a single event upset occurs at memory cell MC1, and the value stored in memory cell MC1 changes from a high value to a low value. PIP P1 is inadvertently disabled, and interconnect line IL1 is isolated from interconnect line IL0. If logic block LB1 was driving logic block LB2 through interconnect line IL0, for example, the connection no longer exists, and the circuit does not function properly.
Suppose instead that a single event upset occurs at memory cell MC3 and the value stored in memory cell MC3 changes from a low value to a high value. PIP P3 is inadvertently enabled. Logic block LB3 tries to place a value on interconnect line IL0, which is already driven by logic block LB1. Contention occurs, which can cause a number of problems ranging from excessive current consumption to a malfunctioning circuit to causing actual damage to the PLD.
Circuits and methods have been developed to avoid the problems associated with single event upsets in non-programmable circuits. One strategy for avoiding such problems is illustrated in FIG. 2. The illustrated circuit is called a triple modular redundancy (TMR) circuit. In essence, the required logic is implemented three times (i.e., in three modules), and the results generated by the three modules are compared. The two that are the same are considered to be correct, and the xe2x80x9cdissenting votexe2x80x9d is thrown out.
The TMR circuit of FIG. 2 includes modules M1-M3, representing three implementations of the same logical function. Each module has a respective output signal 01-03 that drives voting circuit VC. Voting circuit VC implements the function (01 AND 02) OR (02 AND 03) OR (01 AND 03) and provides the result as the output signal OUT of the circuit.
Clearly, this approach overcomes any single event upset that affects the functionality of one of the three modules M1-M3. The module affected by the event produces an incorrect answer, which is overridden in the voting circuit by the other two modules.
However, while the circuit of FIG. 2 works well for errors that occur within one of modules M1-M3, it does not work as well when the circuit is implemented in a PLD. In a PLD, the programmable nature of the routing can cause errors that are more difficult to detect. Specifically, a single event upset that changes the value stored in a PIP memory cell can short together two of the module output signals 01-03. In this event, two of the three inputs to the voting circuit can be incorrect.
Further, circuits implemented in a PLD are not necessarily implemented in discrete regions of the device. The best implementation of the circuit of FIG. 2 in terms of performance or minimizing resource usage might be to physically intermix the logic for the three modules M1-M3. In that case, internal nodes in two different modules can easily be separated by only a single disabled PIP. If a single event upset inadvertently enables such a PIP, internal nodes from the two modules are shorted together. Again, two of three modules are providing suspect data to the voting circuit.
Similarly, single event upsets can cause inadvertent connections between a node in one of the modules and a node in the voting circuit, or between two different nodes in a voting circuit, or between nodes in two different voting circuits.
Further, while a TMR circuit can render a logical function immune from the effects of a single event upset, they do not prevent damage to the PLD that can result from contention caused by the event. Even when the PLD is not damaged, the large amount of power that can be consumed by such a contention is a serious issue in many applications.
Therefore, it is desirable to provide methods for implementing circuits in PLDs that offer protection from the effects of single event upsets. It is further desirable to provide methods for implementing TMR circuits that render such circuits as effective in PLDs as in non-programmable integrated circuits.
The invention provides methods for implementing a circuit in a programmable logic device (PLD) that protect the circuit from the effects of single event upsets. When routing nodes within the circuit using the interconnect lines of the PLD, two routed nodes are separated from each other by at least two programmable interconnect points (PIPs). Therefore, if a single event upset causes a PIP to become inadvertently enabled, the affected node is coupled to an unused interconnect line, instead of to another node within the circuit.
In some embodiments, a triple modular redundancy (TMR) circuit is implemented. Routed nodes in one module are separated from routed nodes in another module by at least two PIPs. However, nodes within the same module can be separated by only one PIP, because the TMR structure of the circuit can compensate for errors that are confined to a single module.
A method according to a first embodiment maps a circuit including two sub-circuits and two nodes coupled to the two sub-circuits into a PLD with logic blocks and interconnect lines. The method includes the steps of assigning the two sub-circuits to logic blocks within the PLD, assigning the first node to a first interconnect line in the PLD, marking the first interconnect line as used, marking all interconnect lines within one PIP of the first interconnect line as used, and assigning the second node to a second interconnect line while avoiding all interconnect lines, marked as used. Thus, a single event upset that inadvertently enables one PIP cannot short the first and second nodes together.
In some embodiments, the method is applied to a TMR circuit, with the first and second nodes being output nodes from first and second modules. In other embodiments, the first and second nodes are in one of the modules and the voting circuit. In still other embodiments, interconnect lines within one PIP of the used interconnect line are marked as used with respect to nodes in other modules, but not marked as used with respect to nodes in the same module.
A method according to another embodiment also maps a circuit including two sub-circuits and two nodes coupled to the two sub-circuits into a PLD with logic blocks and interconnect lines. In this embodiment, the method includes the steps of assigning the two sub-circuits to logic blocks within the PLD, routing the first node using a first interconnect line in the PLD, and routing the second node using a second interconnect line in the PLD wherein connecting the first and second interconnect lines to each other would require the enabling of more than one PIP. Again, a single event upset that inadvertently enables one PIP cannot short the first and second nodes together.
A method according to another embodiment addresses the steps of implementing a triple modular redundancy (TMR) circuit in a PLD. According to this embodiment, the method includes the steps of implementing three modules and a voting circuit in the PLD, and routing output nodes from each module to input terminals of the voting circuit using only unused interconnect lines. After routing each of the first and second output nodes using associated interconnect lines, the associated interconnect lines are marked as used. All interconnect lines programmably connectable to the associated interconnect lines through a single PIP are also marked as used.
In some embodiments, interconnect lines within one PIP of an assigned interconnect line are only marked as used with respect to nodes in other modules, and not with respect to nodes within the same module. This improvement increases the number of interconnect lines available for routing the modules.